Audit evidence
Also known as: Artifacts, Supporting documentation, Audit trail
Audit evidence is the information gathered by an auditor to determine whether a process, control, or system meets specific requirements. It serves as the factual basis for the auditor's conclusions and final report. To be valid, this evidence must be sufficient in quantity and appropriate in quality to support the audit findings.
In practice
A practitioner collects evidence by requesting system-generated logs, taking screenshots of security configurations, or reviewing signed policy documents during a compliance assessment.